Vulnerability Overview
Exploitation Activity
Exploitation Intelligence
On April 3, 2025, Ivanti disclosed CVE-2025-22457, a critical buffer overflow vulnerability affecting Ivanti Connect Secure and other products. The vulnerability allows unauthenticated remote code execution, and evidence of exploitation was observed in mid-March 2025. Threat actor UNC5221, linked to...
On October 13, 2026, Ivanti disclosed a high-severity zero-day vulnerability tracked as CVE-2026-104935, affecting its Connect Secure (ICS) VPN appliances. This authentication bypass flaw allows unauthenticated attackers to execute arbitrary commands, with exploitation confirmed since at least Octob...
In the 2025 Poland Wiper Attacks, adversaries employed obfuscated files to conceal malware artifacts, specifically using Base64-encoded ZIP archives to evade detection. The attacks affected various systems, leveraging techniques like encrypted payloads and user execution. Tools such as certutil were...
